# Record Patch Tuesday, a phishing takedown, and laptop farms > An exploited Mark-of-the-Web bypass, 1bn+ scam messages' worth of domains seized, and Texas raids. - Series: It's Probably Nothing - Publisher: Sierra Echo Charlie - Edition date (Pacific/Auckland): 2026-10-15 - Edition number: 3 - Status: Published edition - Language: en-NZ - [Canonical web edition](https://ipn.nz/editions/2026-10-15) - [Download PDF](https://ipn.nz/pdf/IPN-2026-10-15.pdf) - [MP3 audio](https://ipn.nz/audio/IPN-2026-10-15.mp3) (4:36, 4418290 bytes) - [Standalone transcript](https://ipn.nz/transcripts/2026-10-15.md) ## Opening A bit calmer than the last couple of days. Microsoft shipped a record-sized Patch Tuesday with one exploited bug that matters to almost everyone. There's also a takedown aimed at the phishing kits behind those parcel and toll texts, and some US raids on North Korean laptop farms. ## 1. Microsoft's biggest Patch Tuesday yet includes an exploited Mark-of-the-Web bypass The count depends on who did the maths. BleepingComputer has 1,411 flaws, 70 of them Critical, and SecurityWeek's headline says 1,413. Either way, it's a record, and the one that matters is [CVE-2026-96951](). Microsoft describes it as a command injection flaw in Windows Shell that lets an unauthorised attacker bypass a security feature over a network. Reporting says the feature is Mark of the Web, which is the thing that triggers SmartScreen and Protected View warnings on files that came from somewhere sketchy. Microsoft says it's exploited, though it needs a user to act on a crafted file, such as one sent by email or IM. It hasn't shared anything about the attacks. CISA added it to KEV on 13 October and gave federal agencies until 16 October. According to SecurityWeek, researchers at Fujitsu and Anthropic, plus an independent researcher, each reported it separately, which suggests it wasn't exactly well hidden. The two publicly disclosed bugs are less urgent. CVE-2026-108398 is a .NET Framework WDAC bypass found by James Forshaw, and Microsoft rates exploitation unlikely. CVE-2026-92707 is a MessagePack-CSharp denial-of-service bug. Mallory's summary also flags CVE-2026-103572 (CVSS 8.8), an RCE via indirect prompt injection in the Copilot component shared by Visual Studio and SSMS. We haven't checked that one against Microsoft's advisory. A MotW bypass isn't a crisis on its own, but it removes one of the few speed bumps between a phishing attachment and execution. That makes it a good fit for this week's other story. ### Worth asking This is the last update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016, so if any of those are hanging around, they've just become a different kind of problem. ### Qualifications We couldn't read Microsoft's advisory directly, so the details come from trade reporting and the KEV feed. ### Sources - [Microsoft Patches Exploited Windows Shell Flaw and Copilot Remote Code Execution (Mallory)]() — reporting/context - [Microsoft October 2026 Patch Tuesday fixes 1,411 flaws, 3 zero-days]() — reporting/context - [Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day]() — reporting/context - [CISA Known Exploited Vulnerabilities catalogue (JSON feed)]() — primary source ## 2. Microsoft seizes domains behind three Chinese-language phishing services Microsoft, working with Japan's National Police Agency and Health-ISAC, got a US court order to seize and redirect domains behind YAM Store, CoGUI and Iron Man. Health-ISAC, relaying Microsoft's figures, says that since January the three have enabled more than a billion malicious messages aimed at more than 75,000 organisations in more than 150 countries. The Record reports that Microsoft also disabled more than 20,000 YAM Store-linked accounts and is blocking more than 100,000 impersonation domains. It says Iron Man sells thousands of templates tailored to Australia, Japan, India and others: postal services, traffic fines, tax agencies, banks and telcos. In other words, the stuff in your family group chat. Proofpoint says the CoGUI-family campaigns mostly hit Japan, with some landing in the US, Australia and Italy. Proofpoint expects this to dent the kits' effectiveness. Mallory notes nobody has shown a lasting drop in volume yet, and PhaaS operators do tend to have spare domains lying about. ### Sources - [Microsoft and Partners Disrupt Phishing Ecosystem Behind More Than 1 Billion Messages (Mallory)]() — reporting/context - [Disrupting the service economy behind transnational cybercrime operations (Health-ISAC)]() — primary source - [Disruption targets major Chinese-language phishing kits with Japanese focus (Proofpoint)]() — primary source - [Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals]() — reporting/context ## 3. US raids Texas laptop farms in North Korean IT-worker crackdown The DOJ's Operation Lonestar Roundup searched suspected laptop farms in Texas and seized about 187 devices. SecurityWeek says investigators searched 40 locations. An Ohio indictment charges US nationals Michael James Bostelle and Juan Cecilio Pena Carrillo, who were arrested, along with ten China-based defendants. All of them are presumed innocent. DOJ says the scheme hit more than 70 US employers and brought in about US$3 million for DPRK-controlled entities. Per Mallory's summary, CrowdStrike linked the activity to Famous Chollima and expects only limited, local disruption. That sounds about right for a model that just needs another spare bedroom full of laptops. ### Qualifications The CrowdStrike attribution comes via Mallory's summary and wasn't checked against CrowdStrike's own material. ### Sources - [DOJ Arrests Two in North Korean Laptop-Farm Scheme Targeting U.S. Employers (Mallory)]() — reporting/context - [Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies]() — primary source - [US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms]() — reporting/context ## 4. French fridge attack count reportedly reaches about 700 stores A short update on the supermarket refrigeration story. ComplexDiscovery, citing AP, reports that Finance Minister Roland Lescure told Parliament on Tuesday that about 700 of France's roughly 10,000 supermarkets were affected, and that food supply wasn't at risk. That's about double the earlier tallies. The same report says Copeland acknowledged a 'vulnerability' in a discontinued, end-of-life generation of controllers, though it hasn't confirmed any compromises in France. It also says a Reuters scan found at least 4,500 Danfoss web interfaces still online. ### Qualifications All of this comes through one aggregator relaying AP. AP doesn't say how the 700 figure was compiled, and the remarks may predate today's window. Nothing links the attack to a specific Copeland or Danfoss CVE. ### Sources - [Cyberattack Manipulates Refrigeration at French Supermarkets, Destroying Fresh Stock (Mallory)]() — reporting/context - [Refrigeration hack affected about 700 French supermarkets, government says, as Danfoss interfaces stay online]() — reporting/context - [Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération – CERT-FR (CERTFR-2026-ALE-012)]() — primary source ## Audio transcript Narrated using an AI voice. Hi, it's It's probably nothing. Today's a bit calmer than the last couple of days: a record-sized Patch Tuesday with one exploited bug that matters to almost everyone, a takedown aimed at the kits behind those parcel and toll texts, and US raids on North Korean laptop farms. Microsoft's count depends on who did the maths. BleepingComputer has 1,411 flaws, 70 of them critical, while SecurityWeek's headline says 1,413. Either way, it's a record. The one that matters is a Windows Shell bug that Microsoft describes as command injection letting an unauthorised attacker bypass a security feature over a network. Reporting says that feature is Mark of the Web, the thing that triggers SmartScreen and Protected View warnings on files from somewhere sketchy. Microsoft says it's being exploited, though someone still has to act on a crafted file, such as one sent by email or IM. It hasn't shared anything about the attacks. CISA added it to its known exploited list on the thirteenth and gave US federal agencies until the sixteenth. SecurityWeek says Fujitsu, Anthropic and an independent researcher each reported it separately, which suggests it wasn't exactly well hidden. On its own, a Mark of the Web bypass isn't a crisis, but it removes one of the few speed bumps between a phishing attachment and execution. One caveat: we couldn't read Microsoft's advisory directly, so these details come from trade reporting and the CISA feed. The two publicly disclosed bugs are less urgent: a dot NET Framework WDAC bypass found by James Forshaw, which Microsoft rates as unlikely to be exploited, and a denial-of-service bug in MessagePack for C sharp. Mallory's summary also flags a remote code execution bug, rated 8.8, involving indirect prompt injection in the Copilot component shared by Visual Studio and SQL Server Management Studio. We haven't checked that one against Microsoft's advisory. This is also the last update for Windows 11 24H2 Home and Pro, and for Windows 10 Enterprise LTSB 2016. If any of those are still hanging around, they've just become a different kind of problem. That phishing point leads nicely into the takedown. Microsoft, working with Japan's National Police Agency and Health-ISAC, got a US court order to seize and redirect domains behind three Chinese-language phishing services: YAM Store, CoGUI and Iron Man. Health-ISAC, relaying Microsoft's figures, says that since January they've enabled more than a billion malicious messages aimed at over 75,000 organisations in more than 150 countries. The Record says Microsoft also disabled more than 20,000 YAM Store-linked accounts and is blocking more than 100,000 impersonation domains. Iron Man reportedly sells thousands of templates tailored to Australia, Japan, India and other countries, covering postal services, traffic fines, tax agencies, banks and telcos. In other words, the stuff in your family group chat. Proofpoint says the CoGUI-family campaigns mostly hit Japan. Proofpoint expects the takedown to dent the kits' effectiveness, but nobody has shown a lasting drop in volume yet, and these operators do tend to have spare domains lying about. In the US, the Justice Department's Operation Lonestar Roundup searched suspected laptop farms in Texas and seized about 187 devices. SecurityWeek says investigators searched 40 locations. An Ohio indictment charges two US nationals, who were arrested, and ten China-based defendants. All of them are presumed innocent. The DOJ says the scheme hit more than 70 US employers and brought in about three million US dollars for entities controlled by North Korea. According to Mallory's summary, which we haven't checked against CrowdStrike's own material, CrowdStrike links the activity to Famous Chollima and expects only limited, local disruption. That sounds about right for a model that just needs another spare bedroom full of laptops. A quick update on the French supermarket fridges. ComplexDiscovery, citing AP, reports that the finance minister told Parliament about 700 of France's roughly 10,000 supermarkets were affected, about double the earlier tallies, and that food supply wasn't at risk. AP doesn't say how that figure was compiled. Copeland has reportedly acknowledged a vulnerability in a discontinued generation of controllers but hasn't confirmed any compromises in France, and a Reuters scan reportedly found at least 4,500 Danfoss web interfaces still online. Nothing links the attack to a specific Copeland or Danfoss flaw yet. That's the lot. Patch the Shell bug, ignore the toll text, and I'll catch you tomorrow. Don't forget, all our threat intelligence comes from Mallory dot A I. If you want intelligence your team can act on, reach out for a chat. ## Publisher Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com). Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)